[[编辑]]JWT Spring Security：如何读取角色。hasRole（）或。hasAuthority（），其中他们查看用户角色

Question

我试图使用HTTP配置中的角色向spring actuator服务添加授权，但它不起作用，响应为“禁止403”，这意味着用户未经授权<因此，我的问题是，具体在哪里。hasRole（）在使用JWT令牌时查找已登录的用户角色

这是类中扩展WebSecurityConfigrerAdapter类的config方法

    protected void configure(HttpSecurity http) throws Exception {
    http.cors()
        .and()
        .csrf().disable()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .addFilterBefore(new JwtTokenVerifier(jwtConfig), UsernamePasswordAuthenticationFilter.class)
        .authorizeRequests()
        .antMatchers("/auth/**").permitAll()
        .antMatchers("/actuator/**").hasRole("ACTUATOR")
        .anyRequest()
        .authenticated()
        .and()
        .formLogin().disable();
    }   

这里我把JWT令牌中的角色

public String generateJwtToken(UserDetailsImpl userDetails) {
        Map<String, Object> claims = new HashMap<>();
        Set<String> Userroles = new HashSet<>();

        Role r1 = new Role();
        r1.setDescription("ROLE_ACTUATOR");
        r1.setId(1L);
        
        Set<Role> roles = new HashSet<>();
        roles.add(r1);
        
        for(Role role:roles){
            Userroles.add(role.getDescription());
        }
        claims.put("Roles",Userroles.toArray());
        claims.put("userId", userDetails.getId());
        
    return Jwts.builder()
            .setClaims(claims)
        .setSubject(userDetails.getUsername())
        
        .setIssuedAt(new Date())
        .setExpiration(java.sql.Date.valueOf(LocalDate.now().plusDays(getTokenExpirationAfterDays())))
        .signWith(Keys.hmacShaKeyFor(getSecretKey().getBytes())).compact();
    }  

那么什么是错的或缺失的呢？提前感谢
以下是JWT自定义筛选器的更新：

public class JwtTokenVerifier extends OncePerRequestFilter {

    private JwtConfig jwtConfig;

    public JwtTokenVerifier(JwtConfig jwtConfig) {
    super();
    this.jwtConfig = jwtConfig;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {

    String authorizationHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
    if (authorizationHeader == null || authorizationHeader.isEmpty() || !authorizationHeader.startsWith(jwtConfig.getTokenPrefix())) {
        String requestParam = request.getParameter("token");
        if (requestParam != null && !requestParam.isEmpty() && requestParam.startsWith(jwtConfig.getTokenPrefix())) {
        authorizationHeader = requestParam;
        } else {
        filterChain.doFilter(request, response);
        return;
        }
    }
    try {
        if (jwtConfig.validateJwtToken(authorizationHeader)) {
        String username = jwtConfig.getUserNameFromJwtToken(authorizationHeader);

        Authentication auth = new UsernamePasswordAuthenticationToken(username, new WebAuthenticationDetailsSource().buildDetails(request), null);
        SecurityContextHolder.getContext().setAuthentication(auth);
        }

    } catch (Exception e) {
        e.printStackTrace();
        response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
    }
    filterChain.doFilter(request, response);
    }

}

Answer 1

感谢@SteveRiesenberg，正如聊天中所说，“如果自定义JWT筛选器没有处理角色，那么这就是问题所在。在执行身份验证时，必须填充角色（权限）。”
因此，由于角色不在筛选器中处理，因此它们不会通过安全链传递
过滤器的代码编辑如下：

UserDetailsImpl userDetails  = (UserDetailsImpl) userDetailsService.loadUserByUsername(username);
Collection<? extends GrantedAuthority> authorities = userDetails.getAuthorities();
                
Authentication auth = new UsernamePasswordAuthenticationToken(username, new WebAuthenticationDetailsSource().buildDetails(request), authorities); 

其中权限传递给UsernamePasswordAuthentiationToken和UserDetailsImpl是Spring提供的UserDetailsImpl类的实现

Answer 2

在WebSecurityConfigrerAdapter扩展中，我看到了ACTUATOR，但在用户详细信息定义中，我看到了ROLE_ACTUATOR。这是不匹配吗？